Prisma SASE - Block IP

This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy. If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group). And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs.

Pack

PrismaAccess

Tasks

13

Inputs

• TSGID — Tenant services group ID. If not provided, the tsg_id integration parameter will be used as the default.
• IP — The address value (should match the type).
• Folder — The configuration folder group setting. The default value is 'Shared'.
• StaticAddressGroupName — The static address group name will be appended with IP indicators.
• AutoCommit — Possible Values: True -> Will commit and push configuration. False -> Manual push will be required. Else --> Will ignore the push section and continue the playbook.

Outputs

• PrismaSase.AddressGroup — The Prisma Access Address group object.
• PrismaSase.AddressGroup.id — The address group ID.
• PrismaSase.AddressGroup.name — The address group name.
• PrismaSase.AddressGroup.description — The address group description.
• PrismaSase.AddressGroup.addresses — The address group addresses.
• PrismaSase.AddressGroup.dynamic_filter — The address group filter.
• PrismaSase.AddressGroup.folder — The address group folder.
• PrismaSase — The root context key for Prisma SASE integration output.
• PrismaSase.SecurityRule — Created security rule.
• PrismaSase.SecurityRule.action — Security rule action.
• PrismaSase.SecurityRule.application — Security rule application.
• PrismaSase.SecurityRule.category — Security rule category.
• PrismaSase.SecurityRule.description — Security rule description.
• PrismaSase.SecurityRule.destination — Security rule destination.
• PrismaSase.SecurityRule.folder — Security rule folder.
• PrismaSase.SecurityRule.from — Security rule from field (source zone(s)).
• PrismaSase.SecurityRule.id — Security rule ID.
• PrismaSase.SecurityRule.name — Security rule name.
• PrismaSase.SecurityRule.position — Security rule position.
• PrismaSase.SecurityRule.service — Security rule service.
• PrismaSase.SecurityRule.source — Security rule source.
• PrismaSase.SecurityRule.source_user — Security rule source user.
• PrismaSase.SecurityRule.to — Security rule to field (destination zone(s)).
• PrismaSase.SecurityRule.profile_setting — The Security rule group object in the rule.
• PrismaSase.SecurityRule.profile_setting.group — Security rule group.
• PrismaSase.CandidateConfig — Configuration job object.
• PrismaSase.CandidateConfig.job_id — Configuration job ID.
• PrismaSase.CandidateConfig.result — The configuration push result, e.g., OK, FAIL.
• PrismaSase.CandidateConfig.details — The configuration push details.
• PrismaSase.Address — Created address object.
• PrismaSase.Address.description — Address description.
• PrismaSase.Address.folder — Address folder.
• PrismaSase.Address.id — Address ID.
• PrismaSase.Address.type — Address type.
• PrismaSase.Address.address_value — Address value.
• PrismaSase.Address.name — Address name.

Commands used

• prisma-sase-address-group-create
• prisma-sase-address-group-list
• prisma-sase-candidate-config-push
• prisma-sase-security-rule-create